Acceptable use policy

Version: 1.0, effective 25 August 2026

This policy covers everyone who puts content into RouteRound. That is three different groups of people, and it matters which one you are:

• Subscribers and their teams — the contractor's office staff and crews. This policy is part of the subscription terms.
• Portal users — the customers a contractor shares a schedule with, and their colleagues. You have no subscription with us. This policy, together with our Privacy Notice, is the whole of your agreement with us, and you accept it when you first sign in to the portal or submit anything through it.
• Anyone who opens an introduction link we have generated at a portal user's request.

RouteRound is operated by Desultory Ltd, registered in England and Wales, company number 17361684, registered office 133 Berrall Way, Billingshurst, England, RH14 9PQ.

1. What "content" means here

Content is anything a person types, draws, uploads or attaches: job notes, site and access notes, photographs, drawn signatures, certificate scans, custom form entries, portal requests, and the labels and notes written on an introduction link.

Most of it is ordinary working record-keeping, seen only by the contractor's own team. Some of it travels further than people expect, and that is the reason this policy exists:

• A portal request — the site name, address, postcode and free-text notes a customer submits — is readable by the contractor's whole organisation and by every colleague on the same portal account. If your facilities manager and your caretaker are both on the account, both can read what the other wrote.
• An introduction link carries the label and the one-line note the sender wrote, and shows them to whoever opens the link — a firm that has no account with us and has never agreed to anything. Write it as though a stranger will read it, because one will.
• A completion report emailed at a contractor's direction carries site details, on-site times, work notes, photographs, and the attending crew's names and certificate expiry dates.

2. What you must not put into RouteRound

You must not create, upload, submit or transmit content that:

• is unlawful, or encourages or helps anyone to break the law;
• harasses, bullies, threatens, defames or is abusive towards any person;
• is hateful or discriminatory on the basis of race, religion, sex, sexual orientation, gender reassignment, disability, age, pregnancy, marriage or civil partnership;
• is sexual, obscene, or otherwise plainly inappropriate in a working record;
• depicts or encourages violence, self-harm or cruelty;
• infringes anyone's copyright, trade marks or other rights;
• is deliberately false, or is fabricated in order to mislead a customer, an auditor or a regulator;
• contains malicious code, or is designed to interfere with the service or with anyone using it.

We have no tolerance for objectionable content or abusive behaviour. We remove it and we remove the accounts responsible.

3. Photographs and other people

3.1 Photographs are taken on other people's property, and sometimes people are in them. Take what the job needs and no more.

3.2 Do not photograph people who are not part of the work, do not photograph the inside of a home beyond what the job requires, and do not upload a photograph a reasonable occupier would object to.

3.3 Do not use a photograph taken for a job record for anything else — marketing, social media, a dispute with a neighbour — without the permission of the people it concerns.

3.4 If you are a subscriber, you are the data controller for these photographs and the obligation to have a lawful basis is yours. Clause 3 of the Data Processing Agreement sets out what we hold and in what capacity.

4. Things RouteRound is not for

4.1 Do not enter special category data. No health information, no biometric data used to identify someone, no identity documents. There are no fields for these, and putting them in notes or certificate photographs does not make them safe.

4.2 Criminal records clearance is a special case, and one the app does support. You may record that a named person holds a vetting or clearance requirement — a DBS level, an NPPV, a BPSS. You must not record what a disclosure said, an offence history, or a certificate reference number. Clause 3.2 of the DPA explains why this distinction matters and what it obliges you to do.

4.3 Do not use free-text fields as a filing cabinet for information that belongs somewhere with proper access controls — bank details, passwords, medical notes about an employee.

4.4 Access notes contain gate codes and key-safe codes. They are readable by everyone in the contractor's organisation. Treat that as the design, not as a leak, and think about who is in your organisation.

5. Using the service itself

You must not:

• attempt to access another subscriber's or another portal account's data;
• probe, scan or test the security of the service, except by writing to security@routeround.co.uk first — see security.txt;
• circumvent rate limits, or automate submissions at a volume the service is plainly not built for;
• scrape, copy or bulk-extract data you are not entitled to;
• decompile or reverse-engineer the software, except so far as the law permits despite this;
• impersonate anyone, or misrepresent who you are or who you work for, including on an introduction link.

6. Reporting something

6.1 If you see content that breaches this policy, report it to jack@routeround.co.uk. Tell us what you saw and where.

6.2 Every place in RouteRound where one party sees another's words carries a Report control: a customer's request in the contractor's inbox, the contractor's reply in the customer's portal, a notice a customer posts to a contractor's crews, a completed-job report, and the introduction link page. The introduction page can be reported by somebody with no account at all, because that is who it is shown to.

Reports reach a person, are logged with the content as it read when it was reported, and are assessed against section 2 of this policy. We do not put a Report control on a firm's own internal records — its job notes and photographs — because those are not shown to anybody outside the firm and section 8.1 explains why we do not read them.

6.3 Reports reach the director of Desultory Ltd directly. We are one person, so there is no queue and no triage tier — and no pretence of a 24-hour desk.

6.3 What happens next. We acknowledge every report within 2 working days. We assess it and, where we agree it breaches this policy, we remove the content and tell the person who reported it what we did. Where the content sits inside a subscriber's own records and does not otherwise breach this policy or the law, we will normally raise it with that subscriber rather than reach into their data ourselves — and we will tell you that is what we have done.

6.4 Content that may be illegal goes further: we preserve what we can, remove it, and report it to the police or the relevant authority where we are required or where it is plainly the right thing to do.

6.5 Blocking. A subscriber can remove any member of their own team, and can stop sharing with any portal user, at any time. We can block any account from the service. If someone is using RouteRound to harass you, tell us at jack@routeround.co.uk and we will block them.

7. What we do if you breach this policy

Depending on how serious it is, we may: remove the content; warn you; suspend your access; end a subscription under clause 13.3 of the subscription terms; or report the matter to the authorities.

We aim to warn before we suspend, and to explain what we have done and why. We will not always be able to, and where the content is illegal or the risk to someone is immediate we will act first.

If you think we got it wrong, reply to us. A person will look at it again. If it concerns your personal data, our complaints procedure applies and has its own timescales.

8. What we do not do

8.1 We do not read your working records. There is no proactive scanning of job notes, photographs or forms, and no automated moderation of them. We act on reports. Saying otherwise would be untrue and would also be a poor description of a product whose whole point is that your records are yours.

8.2 Two exceptions, and they are narrow. Content submitted through the client portal, and the note on an introduction link, go to people outside the contractor's organisation. On those two surfaces we apply an automated check at submission, and we may review the content on report.

Because that sentence is the kind that gets overread, here is exactly what the check is and is not. It is a short list of unambiguous threats of violence, matched on whole words after folding accents, punctuation and repeated letters. It is not moderation, it is not scanning, and it will not catch a determined person — a word list is defeated with one keystroke. It is kept deliberately short and narrow because a false positive stops a customer asking their contractor to cut a hedge, which is a real cost paid by somebody who has done nothing wrong. It contains no term with an innocent reading in this trade; we removed one during development for exactly that reason, when it turned out to block a customer describing oilseed rape.

The control we actually rely on is reporting. Every surface carrying somebody else's words has a Report control, reports reach a person, and we act on the ones that break section 2.

8.3 We do not monitor for illegal content generally. Nothing here makes us responsible for content a user creates.

9. Changes

We may update this policy. Material changes are published with a new version number and date, and subscribers are told by email. Continuing to use RouteRound after that accepts the change.

10. Contact

Reports: jack@routeround.co.uk · General: hello@routeround.co.uk Privacy: privacy@routeround.co.uk · Security: security@routeround.co.uk

Desultory Ltd, 133 Berrall Way, Billingshurst, England, RH14 9PQ. Registered in England and Wales, company number 17361684.